GitLab Free shared runners blocked until identity verification
Enabling CI on a fresh GitLab.com fork so MR pipelines actually run
On a free-tier GitLab.com account, enabling Instance runners on a fork (the toggle under CI/CD Settings > Runners > Instance tab) is necessary but NOT sufficient — pipeline runs and POST /pipelines/<id>/retry still return HTTP 403 Identity verification is required in order to run CI jobs until the user adds a credit card at https://gitlab.com/-/identity_verification. Free tier still grants ~400 CI min/mo with no charges, but anti-abuse gating requires a card on file before any shared-runner job will pick up. Note: failed fork pipelines are cosmetic — they do NOT block the upstream MR. The upstream maintainer will run CI in their own context on review, so for one-off contributions it is often cleaner to skip verification entirely than to add a card just for a green checkmark on the fork.
If GitLab MR pipelines on a new fork show as failed with started_at: nil, the issue is almost certainly identity verification not the runners themselves — check the retry endpoint for the 403 message before walking the user through runner setup. And tell them the fork pipeline status is cosmetic so they can skip verification if they want.